To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Parkin Beacher Ltd 


20 Cow Green, Halifax, West Yorkshire, United Kingdom HX1 1HX 


The Information Commissioner (“Commissioner”) has decided to issue 
Parkin Beacher Ltd (“PB Ltd”) with a monetary penalty under section 
55A of the Data Protection Act 1998 (“DPA”). The penalty is being 
issued because of a serious contravention of regulation 21B of the 
Privacy and Electronic Communications (EC Directive) Regulations 
2003. 


This notice explains the Commissioner's decision. 


Legal framework 


PB Ltd, whose registered office is given above (Companies House 
Registration Number: 11592415) is the organisation stated in this 
notice to have used a public electronic communications service for the 
purpose of making unsolicited calls for the purposes of direct marketing 
in relation to occupational pension schemes or personal pension 


schemes contrary to regulation 21B of PECR. 
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Regulation 21B paragraph (1) of PECR provides that: 


"(1) A person must not use, or instigate the use of, a public electronic 


communications service to make unsolicited calls to an individual 


for the purpose of direct marketing in relation to occupational 


pension schemes or personal pension schemes, except where 


paragraph (2) or (3) applies.” 


Regulation 21B paragraphs (2), (3), and (4) provide that: 


"(2) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; and 


the called line is that of an individual who has previously 
notified the caller that for the time being the individual 
consents to such calls being made by the caller on that 


line. 


(3) This paragraph applies where— 


(a) 


(b) 


the caller is an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a 


personal pension scheme; 


the recipient of the call has an existing client relationship 
with the caller on the line and the relationship is such that 
the recipient might reasonably envisage receiving 
unsolicited calls for the purpose of direct marketing in 
relation to occupational pension schemes or personal 


pension schemes; and 
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(c) the recipient of the call has been given a simple means of 


refusing (free of charge except for the costs of the 


transmission of the refusal) the use of the recipient's 


contact details for the purpose of such direct marketing, at 


the time that the details were initially collected and, where 


the recipient did not initially refuse the use of the details, 


at the time of each subsequent communication. 


(4) A subscriber must not permit the subscriber’s line to be used in 


contravention of paragraph (1)”. 


6. Regulation 21B paragraph 5 materially states that: 


"(5) In this regulation— 


(a) “authorised person” has the meaning given in section 31 of 
the Financial Services and Markets Act 2000; 


(b) “direct marketing in relation to occupational pension 


schemes or personal pension schemes” includes— 


(i) 


(ii) 


(iii) 


the marketing of a product or service to be 
acquired using funds held, or previously held, 
in an occupational pension scheme or a 


personal pension scheme, 


the offer of any advice or other service that 
promotes, or promotes the consideration of, 
the withdrawal or transfer of funds from an 
occupational pension scheme or a personal 


pension scheme, and 


the offer of any advice or other service to 


enable the assessment of the performance of 
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an occupational pension scheme or a personal 


pension scheme (including its performance in 


comparison with other forms of investment); 


(c) “existing client relationship” does not include a relationship 
established at the instigation of the caller primarily for the 


purpose of avoiding the restriction in paragraph (1); and 


(d) “occupational pension scheme” and “personal pension 
scheme” have the meanings given in section 1(1) of the 


Pension Schemes Act 1993.” 


Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of any 
advertising material which is directed to particular individuals”. This 
definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


Prior to 29 March 2019, the European Directive 95/46/EC defined 
‘consent’ as “any freely given specific and informed indication of his 
wishes by which the data subject signifies his agreement to personal 


data relating to him being processed”. 


Consent in PECR is now defined, from 29 March 2019, by reference to 
the concept of consent in Regulation 2016/679 (“the GDPR”): 
regulation 8(2) of the Data Protection, Privacy and Electronic 
Communications (Amendments etc) (EU Exit) Regulations 2019. Article 
4(11) of the GDPR sets out the following definition: “‘consent’ of the 
data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her”. 
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10. Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 
processing operations despite it being appropriate in the individual 


case”. 


11. “Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


12. A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


13. Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 
Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 
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(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


PB Ltd, which operates under the trading name ‘Your Pension Options’, 
was identified following a series of reports from the Financial Conduct 
Authority (“FCA”) which indicated that a number of calls had been 
received by individuals from an organisation identifying itself variously 
as ‘Your Pension Options’ and ‘Pension Choice’, from a single particular 
Calling Line Identifier (“CLI”): 07534 987744. 
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It is understood that PB Ltd, as an ‘Introducer Appointed 
Representative’ (“IAR”) for an authorised ‘Principle’, would engage in 


calls to individuals relating to possible pension reviews, with a view to 


arranging an introduction to its Principle. 


The Commissioner was able to identify a number of complaints which 
had been made between 1 February 2019 and 30 September 2019; all 
of the complaints related to pensions, save for one of the calls which 
was silent (albeit still originating from 07534 987744). 


The Commissioner, from separate enquiries with PB Ltd’s Principle, was 
able to establish that PB Ltd sourced the data for its calls from a third- 
party data supplier. This supplier would itself obtain the data from 


various websites including qi, 
SS 2: 


Having reviewed these websites it is apparent that individuals signing 
up are required to agree to the Privacy Policy for each site. Those 
privacy policies detail long and exhaustive lists of sectors about which 
an individual may receive marketing, and provide lists of named 
organisations which will be passed the individual’s information for the 
purpose of marketing. There does not appear to be any way for 
individuals to select which, if any, of the sectors or named 
organisations they would wish to have their details passed to, or 


receive marketing material from. 


On 22 October 2019 the Commissioner sent an initial investigation 
letter to PB Ltd, setting out her concerns with PB Ltd’s compliance with 
PECR. 


A response was received on 13 November 2019 explaining that 
between 1 February 2019 and 30 September 2019 PB Ltd had made 
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96,817 calls using data obtained from a third-party data supplier, and 

that there were two particular CLIs in use by PB Ltd: 07534 987744 

and 01422 897808. It was later clarified by PB Ltd that these two 

particular CLIs were the only ones in use by them between 1 February 


2019 and 30 September 2019. From those CLIs, the Commissioner had 


identified a total of 16 complaints over the relevant period. 


On 13 November 2019 the Commissioner requested further 
information, specific to the making of pension calls and PB Ltd’s due 
diligence on purchased data. In response, on 27 November 2019, PB 
Ltd confirmed that all 96,817 related to pensions, and provided a copy 
of a compliance questionnaire regarding the data purchased from its 
third-party data provider dated 24 October 2017. 


On 4 December 2019 the Commissioner sent a further letter to PB Ltd, 
seeking evidence that PB Ltd were ‘authorised’, pursuant to regulation 
21B PECR, to make calls relating to occupational/personal pension 


schemes; a copy of its contract with its Principle was also requested. 


In response on 11 December 2019, PB Ltd claimed that it did not 
conduct direct marketing calls relating to pension schemes, rather they 
would make a “simple verification call to individuals who have actively 
consented to be contacted with a view to arranging a financial review”; 
furthermore PB Ltd suggested that, as an IAR, it is “an exempt person 
for the purposes of carrying out regulated activities relating to effecting 
introductions[...]". PB Ltd also provided a copy of an unsigned and 
undated ‘Service Level Agreement’ between itself and its Principle, 
although the Commissioner noted from the metadata of this '.docx File’ 
document that it was created at 14:55 that same day, and was last 


amended at 15:09, before being sent to the Commissioner at 15:16. 
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In subsequent correspondence, PB Ltd provided a copy of its call script. 
This call script states that the purpose of PB Ltd’s call to individuals 
was to provide an introduction to a Financial Advisor to conduct a 
review of the recipient’s current pension arrangements. It is clear from 
this sample script that PB Ltd sought to offer a service to enable the 


assessment of the performance of an occupational pension scheme or a 


personal pension scheme. 


Of the relationship between itself and its Principle, PB Ltd explained 
during the investigation that its principle pays it a “management fee” 


on an annual basis to cover overheads. 


The Commissioner subsequently sought to clarify the figures for calls 
made and CLIs used by PB Ltd in an email of 29 May 2020, however PB 


Ltd failed to respond, despite a further chaser email. 


The complaints received via the Commissioner’s online reporting tool, 


from CLIs attributed to PB Ltd over the relevant period, include: 


e “Woman called using my first name and wanted to know and 


discuss if I had any private or frozen pensions"; 


e “Asked whether I had a company pension or a frozen pension. I 


made my excuses and left"; 


e “Offering pension review as she is concerned about people losing 
out on high charges, underperformance and not getting annual 
pension statements. she claimed to have got my data from a 
government pension website and was trying to book me an 
appointment with a financial adviser. I am a financial adviser and 
know that these calls are now banned. for the uninitiated she was 


almost claiming she was working for a company on behalf of 
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government, which I know she is not. really cagey about giving 


me her address or where she had got my data from.”; 


e “Call regarding my previous pensions looking to transfer the 


benefits”; 


e “Very assertive male saying my first name in a persistent manner 


saying he was working from an authorised pensions database”. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute a 
contravention of regulation 21B PECR by PB Ltd and, if so, whether the 


conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that PB Ltd has contravened regulation 21B of 
PECR. 


The Commissioner finds that the contravention was as follows: 


Between 1 February 2019 and 30 September 2019 PB Ltd made 16 
unsolicited calls for the purposes of direct marketing in relation to 
occupational pension schemes or personal pension schemes contrary to 
regulation 21B of PECR, with those individuals then proceeding to make 


complaints. 


The Commissioner is satisfied that the contravention could have been 
far higher, since over the relevant period PB Ltd has admitted to 


making 96,817 direct marketing calls for the purposes of direct 
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marketing in relation to occupational pension schemes or personal 
pension schemes. Despite being asked to do so, PB Ltd has failed to 
provide details of how many of these 96,817 calls were connected, and 


so the full extent of the contravention, and the true impact on 


individuals’ privacy, is not possible to determine. 


The Privacy and Electronic Communications (Amendment) (No. 2) 
Regulations 2018, which came into force on 9 January 2019, amended 
PECR to insert Regulation 21B which restricts calls made for the 
purposes of direct marketing in relation to occupational pension 


schemes or personal pension schemes. 


PB Ltd would contact individuals, whose information they had obtained 
via a third party, with a view to arranging pension review appointments 
for them with its Principle. The calls made by PB Ltd clearly constitute 
‘direct marketing in relation to occupational pension schemes or 
personal pension schemes’ within the definition of regulation 
21B(5)(b)[iii] PECR. Specifically, Regulation 21B(5)(b)[iii] includes 
“the offer of any advice or other service to enable the assessment of 
the performance of an occupational pension scheme or a personal 
pension scheme (including its performance in comparison with other 


forms of investment)”. 


To engage in such calls it is a requirement of regulation 21B PECR that 
the caller be an ‘authorised person or a person who is the trustee or 
manager of an occupational pension scheme or a personal pension 


scheme’. 


Regulation 21B(5)(a) PECR states that “authorised person” has the 
meaning given in Section 31 of the Financial Services and Markets Act 
2000 (“FSMA”). Section 31(1) FSMA lists the categories of persons 
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who would constitute “authorised persons”. IARs are not named on 
this list. 


PB Ltd, is listed on the FCA website as being effective as an IAR 
between 18 January 2019 and 14 August 2020. As an IAR, PB Ltd 
believed that it was an exempt person for the purposes of carrying out 
regulated activities relating to effecting introductions [to its Principle], 
although it disputes the Commissioner’s suggestion that the calls it 


made constituted direct marketing calls relating to pension schemes. 


The Commissioner’s stance is that the calls clearly constituted direct 
marketing calls within the scope of the legislation. Furthermore, IARs 
are not included in the list of categories of “authorised persons” at 
Section 31(1) FSMA. The legislation is clear, that only “authorised 
persons” may engage in unsolicited direct marketing calls relating to 
pension schemes. It may be that PB Ltd, as an IAR, would have been 
exempt in some respects from the general prohibition in relation to 
some regulated activities, however there is a clear distinction between 
being exempt to some limited degree, and being an “authorised 
person” within the meaning of section 31 FSMA 2000. 


This stance has been supported by the FCA which has previously 


advised that Commissioner that an IAR is not an “authorised person”. 


The Commissioner is therefore satisfied that PB Ltd is not an authorised 


person for the purposes of regulation 21B PECR. 


The Commissioner also notes that ‘Your Pension Options’, i.e. the 
trading named used by PB Ltd, does not appear as a registered trading 
name of the company, which is further compounded by the fact that 
there is no existing website under either the name of PB Ltd or ‘Your 
Pension Options’. PB Ltd’s listed ‘Nature of business’ on Companies 


House simply refers to it as being involved with “Market research and 
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public opinion polling”. There is no mention of it as being active in the 


pensions sector. 


The Commissioner is satisfied that PB Ltd is not a trustee or manager 
of an occupational pension scheme or a personal pension scheme for 


the purposes of regulation 21B PECR. 


Therefore, since neither paragraphs 2 or 3 of regulation 21B apply, it is 
the Commissioner’s finding that PB Ltd cannot lawfully make direct 
marketing calls in relation to occupational pension schemes or personal 


pension schemes. 


Even if PB Ltd were an an authorised person or a person who is the 
trustee or manager of an occupational pension scheme or a personal 
pension scheme, the Commissioner is satisfied that PB Ltd had neither 
the consent of those who it called, nor an existing customer 
relationship with them, as required by regulation 21B(2)(b) or (3)(b). 


At the point at which consent was obtained via 
Te, ee 2 
Tee, it is clear that there is an apparent option for 
individuals to select the means by which they may wish to receive 
direct marketing. However, before being able to proceed, individuals 
are required to agree to the website’s privacy policy, with the privacy 
policies themselves dictating the way marketing will be sent, 
apparently regardless of any preferences selected by the individual. 
Furthermore, individuals are denied the ability to select which of the 
listed sectors or organisations they may wish to receive that marketing 
from, which implies that the individual must agree to receive marketing 
from all. In this way, the consents relied upon by PB Ltd cannot be 


said to have been appropriately specific or freely given. 
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The Commissioner is satisfied that, between 1 February 2019 and 30 
September 2019, PB Ltd used a public electronic communications 
service to make 16 unsolicited calls for the purposes of direct 


marketing in relation to occupational pension schemes or personal 


pension schemes contrary to regulation 21B of PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 1 February 2019 and 30 
September 2019 PB Ltd made 16 unsolicited calls for the purposes of 
direct marketing in relation to occupational pension schemes or 
personal pension schemes contrary to regulation 21B of PECR, with 
those individuals then proceeding to make complaints. This represents 


a significant intrusion into the privacy of the recipients of such calls. 


The Commissioner is satisfied that the contravention could have been 
far higher, since over the relevant period PB Ltd has admitted to 
making 96,817 direct marketing calls for the purposes of direct 
marketing in relation to occupational pension schemes or personal 
pension schemes. PB Ltd has failed to provide details of how many of 
these 96,817 calls were connected, however, the Commissioner is 
satisfied that PB Ltd was not lawfully authorised to carry out such 


activities, nor did it hold valid consent to engage in such calls. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 
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Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner does not consider that PB Ltd deliberately set out to 


contravene PECR in this instance. 


The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, the Commissioner has considered whether PB Ltd knew or 
ought reasonably to have known that there was a risk that these 
contraventions would occur. She is satisfied that this condition is met, 
not least because the issue of unsolicited calls in relation to 
occupational pension schemes or personal pension schemes has been 
widely publicised by the media as being a problem, so much so that it 
prompted recent legislative change to prohibit the making of such calls 
unless certain conditions are met. It is reasonable to suppose that any 
organisation wishing to carry out such activities should, and indeed 


must, be aware of its responsibilities in this area. 


The Commissioner has published detailed guidance on her website for 
those carrying out direct marketing calls for the purposes of pension 
schemes, explaining the strict criteria under which such calls can be 
made. This guidance explains such calls must not be made relation to 
pension schemes unless the person calling is a trustee or manager of a 
pension scheme or a is firm authorised by the Financial Conduct 
Authority, and the individual being called has specifically consented to 


such calls or has a defined existing client relationship. 
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Secondly, the Commissioner has gone on to consider whether PB Ltd 


failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 


Reasonable steps in these circumstances would have included ensuring 
that it was, for the purposes of the legislation, an “authorised person”. 
The Commissioner is of the view that if PB Ltd had familiarised itself 
with the relevant legislation, and clear Government and ICO guidance, 
it would have realised that being exempt for the purposes of some 
regulated activities by virtue of being an IAR does not meet the 
required threshold of being “authorised” for the purposes of regulation 
21B PECR, and accordingly it should have known that it could not 
lawfully make unsolicited direct marketing calls for the purposes of 
pension schemes. Additionally, there is no evidence that PB Ltd sought 
to take independent legal advice, or to request advice from the 


Commissioner, prior to engaging in its direct marketing campaign. 


Furthermore, the Commissioner’s direct marketing guidance makes 
clear that organisations acquiring marketing lists from a third party 
must undertake rigorous checks to satisfy themselves that the personal 
data was obtained fairly and lawfully, that their details would be passed 
along for direct marketing to the specifically named organisation in the 
case of live calls, and that they have the necessary consent. Had 
adequate due diligence been carried out with regards to the data it was 
relying on, PB Ltd would have realised that it was insufficient for the 


purposes of demonstrating valid consent. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met 


The Commissioner's decision to issue a monetary penalty 
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The Commissioner has also taken into account the following 


aggravating features of this case: 


Pension calls, in particular, can lead to high levels of financial detriment 
and/or emotional stress. It is for this reason that the restriction on such 


calls was introduced; 


The making of these calls, made without regard for individuals’ privacy 
rights under PECR, would appear to be for financial gain as the 


organisation will profit from any business resulting from the calls; 


PB Ltd have failed to co-operate fully with the Commissioner’s 
investigation and have failed to provide some of the requested 


information. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 
made by PB Ltd on this matter. The representatives provided did not 
seek to challenge the Commissioner’s substantive findings as to the 


contravention as detailed within her Notice of Intent. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 
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The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the financial information provided by 
PB Ltd in the course of its representations, and has considered the 
likely impact of a monetary penalty on PB Ltd. She has decided on the 
information that is available to her that a penalty remains the 


appropriate course of action in the circumstances of this case. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The making of 
unsolicited direct marketing calls, particularly in relation to pension 
schemes, is a matter of significant public and parliamentary concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses currently 
engaging in these practices. This is an opportunity to reinforce the 
need for businesses to ensure that they meet the strict criteria to 
engage in such activities and are only telephoning consumers who want 


to receive these calls. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £50,000 (fifty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
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Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 16 September 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government's general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
15 September 2021 the Commissioner will reduce the monetary 
penalty by 20% to £40,000 (forty thousand pounds). However, you 
should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 
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e the period specified within the notice within which a monetary 


penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


79. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 16t day of August 2021. 


Stephen Eckersley 

Director of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5; Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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